lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

net: fix sk_buff head without data area

Browse Source 
Eric Dumazet spotted that we have to check skb->head instead
of skb->data as skb->head points to the beginning of the
data area of the skbuff. Similarly, we have to initialize the
skb->head pointer, not skb->data in __alloc_skb_head.

After this fix, netlink crashes in the release path of the
sk_buff, so let's fix that as well.

This bug was introduced in (0ebd0ac net: add function to
allocate sk_buff head without data area).

Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Pablo Neira
2013-06-03 09:28:43 +00:00
committed by David S. Miller
parent 9bc297ea06
commit 5e71d9d77c
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
net/core/skbuff.c
View File

@@ -195,7 +195,7 @@ struct sk_buff *__alloc_skb_head(gfp_t gfp_mask, int node)
* the tail pointer in struct sk_buff! * the tail pointer in struct sk_buff!
*/ */
memset(skb, 0, offsetof(struct sk_buff, tail)); memset(skb, 0, offsetof(struct sk_buff, tail));
skb->data = NULL; skb->head = NULL;
skb->truesize = sizeof(struct sk_buff); skb->truesize = sizeof(struct sk_buff);
atomic_set(&skb->users, 1); atomic_set(&skb->users, 1);
@@ -611,7 +611,7 @@ static void skb_release_head_state(struct sk_buff *skb)
static void skb_release_all(struct sk_buff *skb) static void skb_release_all(struct sk_buff *skb)
{ {
skb_release_head_state(skb); skb_release_head_state(skb);
if (likely(skb->data)) if (likely(skb->head))
skb_release_data(skb); skb_release_data(skb);
} }

2
net/netlink/af_netlink.c
View File

@@ -747,7 +747,7 @@ static void netlink_skb_destructor(struct sk_buff *skb)
atomic_dec(&ring->pending); atomic_dec(&ring->pending);
sock_put(sk); sock_put(sk);
skb->data = NULL; skb->head = NULL;
} }
#endif #endif
if (skb->sk != NULL) if (skb->sk != NULL)